{
  "@id": "urn:uuid:e3ef3d2b-747f-45fd-abde-896cc6b9fd9f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T09:14:00.059349+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 is not present in Netty 4.1.74.Final. The vulnerability affects Netty versions before 4.1.44, where HttpObjectDecoder allowed HTTP headers lacking a colon. The target version 4.1.74.Final already contains the upstream fix (commit a7c18d44b4 by Norman Maurer) that was introduced in version 4.1.44. The fix validates that header lines contain a colon separator and throws IllegalArgumentException if missing. Since the fix was already present in the upstream 4.1.74.Final release that TuxCare onboarded, no additional patching was required for this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is not present in Netty 4.1.74.Final. The vulnerability affects Netty versions before 4.1.44, where HttpObjectDecoder allowed HTTP headers lacking a colon. The target version 4.1.74.Final already contains the upstream fix (commit a7c18d44b4 by Norman Maurer) that was introduced in version 4.1.44. The fix validates that header lines contain a colon separator and throws IllegalArgumentException if missing. Since the fix was already present in the upstream 4.1.74.Final release that TuxCare onboarded, no additional patching was required for this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.74.Final-tuxcare.1) is NOT affected by CVE-2021-21290. The vulnerability, which involved creating temporary files with insecure world-readable permissions (-rw-r--r--), was patched in upstream Netty version 4.1.59.Final. Since the target version 4.1.74.Final is newer than 4.1.59.Final, it already contains the upstream fix. The vulnerable code pattern (File.creat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.74.Final-tuxcare.1) is NOT affected by CVE-2021-21290. The vulnerability, which involved creating temporary files with insecure world-readable permissions (-rw-r--r--), was patched in upstream Netty version 4.1.59.Final. Since the target version 4.1.74.Final is newer than 4.1.59.Final, it already contains the upstream fix. The vulnerable code pattern (File.creat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in this target. The upstream Netty 4.1.74.Final release (Feb 2022) already included the security fix (commit 07aa6b59 from Dec 2021) that validates HTTP header names and rejects control characters instead of silently stripping them. TuxCare onboarded this pre-patched upstream version. The vulnerable code pattern is not present because the upstream vendor's fix was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in this target. The upstream Netty 4.1.74.Final release (Feb 2022) already included the security fix (commit 07aa6b59 from Dec 2021) that validates HTTP header names and rejects control characters instead of silently stripping them. TuxCare onboarded this pre-patched upstream version. The vulnerable code pattern is not present because the upstream vendor's fix was ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation checks each iterable value and blocks line breaks that could inject headers or split responses. The setter delegates to setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:194, and each non-null value is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:495. The validating converter rejects unsafe CR/LF sequences at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:456.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation checks each iterable value and blocks line breaks that could inject headers or split responses. The setter delegates to setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:194, and each non-null value is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:495. The validating converter rejects unsafe CR/LF sequences at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:456."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.1.74.Final is not affected by CVE-2026-42580. This version uses Integer.parseInt for chunk size parsing, which properly rejects overflow values by throwing NumberFormatException. The vulnerable manual parsing code (with int overflow) was introduced later in version 4.1.86+ (January 2023) as a performance optimization, nearly a year after 4.1.74.Final was released (February 2022). The ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.74.Final is not affected by CVE-2026-42580. This version uses Integer.parseInt for chunk size parsing, which properly rejects overflow values by throwing NumberFormatException. The vulnerable manual parsing code (with int overflow) was introduced later in version 4.1.86+ (January 2023) as a performance optimization, nearly a year after 4.1.74.Final was released (February 2022). The ta..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:14:00.059349+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http."
    }
  ]
}